The Australian Government’s digital identity system underwent a material shift on 1 July 2024, when the Digital ID Act 2024 (Cth) received Royal Assent and the Australian Taxation Office (ATO) began enforcing stricter identity-proofing requirements for its myGovID credential. Prior to this date, holders of foreign passports who also possessed an Australian visa could sometimes establish a myGovID at a Standard identity strength using manually reviewed documents. The 2024 changes removed several manual-review pathways and mandated that foreign-passport holders reach at least a Standard identity strength through the Australian Government’s Document Verification Service (DVS) or face rejection. For the estimated 2.3 million temporary visa holders recorded by the Department of Home Affairs in its 30 June 2024 stock report, this means the sequence in which identity documents are presented, the visa grant status visible in VEVO, and the type of biometric chip in the passport now determine whether a myGovID can be set up at all. Because myGovID is the sole credential accepted for accessing 126 government online services — including the ATO’s Online services for individuals, Medicare enrolment via myGov, and Centrelink claims through Services Australia — failure to meet the new proofing bar blocks access to tax file number (TFN) applications, Medicare card requests, and income-contingent loan reporting. The practical effect is that a newly arrived skilled migrant holding a Subclass 482 Temporary Skill Shortage visa and a non-biometric passport may be unable to lodge a TFN declaration with their employer, delaying payroll setup and triggering emergency tax withholding at the top marginal rate of 47% (including the Medicare levy) under the ATO’s PAYG withholding schedule effective from 1 July 2024. This article catalogs the current technical requirements, eligible foreign passport types, visa-class constraints, and fallback identity pathways available through Services Australia as at March 2025.
Eligibility Criteria for Foreign-Passport myGovID Setup
Passport Types Accepted by the Document Verification Service
The ATO’s myGovID identity-proofing engine relies on the Attorney-General’s Department DVS to match a live biometric photograph or a scanned passport image against the issuing country’s authoritative record. As of 18 March 2025, the DVS accepts ePassports that contain an ICAO 9303-compliant contactless chip. The Department of Home Affairs publishes a running list of DVS-participating document types; the current register (updated 12 December 2024) confirms that 47 nationalities can verify an ePassport in real time. Holders of non-ePassports — including older machine-readable passports without a chip from India, Vietnam, and the Philippines — cannot complete the DVS match and therefore cannot reach a Standard identity strength through the myGovID app alone.
Visa Subclass and VEVO Status Requirements
A foreign passport alone does not satisfy the “identity in the Australian community” test that the ATO applies at the Standard level. The myGovID system cross-references the passport holder’s visa entitlement through the Department of Home Affairs Visa Entitlement Verification Online (VEVO) service. The visa must be in effect — a bridging visa that has not yet come into force or a visa application that has not been granted will return a “no record found” error. The ATO’s Operational Framework for Digital Identity SP 2024/3, published 15 October 2024, specifies that only substantive visas (Subclasses 100–995) and Bridging Visa A (BVA) or Bridging Visa B (BVB) that are currently active can be used. Bridging Visa C, Bridging Visa E, and criminal justice visas are excluded. This means an applicant who has lodged an onshore protection visa application and holds a Bridging Visa C cannot use myGovID until a substantive visa is granted or they switch to an eligible bridging visa class.
Identity Strength Levels and Access Rights
The myGovID app issues credentials at three identity strengths: Basic, Standard, and Strong. The ATO’s Identity Strength Matrix, last amended 1 January 2025, maps document combinations to each level. A foreign passport verified through DVS plus a current Australian visa achieves Standard strength only if the name, date of birth, and gender match across both records. Standard strength unlocks ATO Online, Medicare enrolment, and Centrelink claims. Strong strength — required for accessing the Australian Business Registry Services as a company director — demands an Australian passport, an Australian driver licence, or an Australian visa evidenced in a foreign passport plus a face-verification scan against a Home Affairs-held image. Foreign-passport holders cannot reach Strong strength unless their visa was granted through an application that included a facial image captured at an Australian Visa Application Centre or through the Department’s biometrics collection program, which as of February 2025 covers 38 nationalities for onshore applicants and 62 nationalities for offshore applicants under the Migration (Biometrics for Visa Applications) Instrument 2024.
Step-by-Step Setup Procedure
Pre-Setup Document Preparation
Before opening the myGovID app, the applicant must gather the physical foreign passport used in the visa application, a mobile device running iOS 15 or Android 10 or later with near-field communication (NFC) enabled, and a stable internet connection. The passport must be the same document linked to the current visa in VEVO. The Department of Home Affairs confirmed in a 3 February 2025 operational advisory that a passport renewed after visa grant must be updated in ImmiAccount before myGovID setup; otherwise, the DVS match will fail because the passport number in VEVO differs from the chip being scanned. The update process through ImmiAccount takes 24–72 hours and does not require a new visa grant.
In-App Identity Proofing Flow
The myGovID app prompts the user to enter their full name exactly as it appears in the machine-readable zone of the passport, followed by the date of birth and the passport number. The app then invokes the device NFC reader to scan the passport chip. The chip must be read within the app’s 90-second timeout window. The extracted data — surname, given names, date of birth, passport number, and issuing country — is hashed and transmitted to the DVS gateway. The DVS response returns a match or mismatch within 15 seconds under normal load conditions documented in the DVS Service Level Agreement 2024–2026. A successful passport match triggers a VEVO lookup using the passport number as the primary key. If VEVO returns an active eligible visa, the app issues a Standard-strength myGovID. The entire process, from app launch to credential issuance, averages 4 minutes when both DVS and VEVO respond within their target latencies.
Troubleshooting Common Failure Points
Three failure patterns dominate the ATO’s myGovID support logs for foreign-passport holders. First, a “document could not be verified” error occurs when the passport chip is not ICAO 9303-compliant or the issuing country has not authorised the DVS to read its ePassport data. Second, a “visa record not found” error appears when the visa is not yet active, the passport number in VEVO is outdated, or the visa subclass is excluded under SP 2024/3. Third, a “name mismatch” error arises when the passport machine-readable zone contains diacritical marks or a name order that differs from the VEVO record; the ATO’s myGovID support guidance dated 18 November 2024 advises applicants to replicate the machine-readable zone string exactly, including surname-first ordering where applicable.
Alternative Identity Verification Pathways
Services Australia In-Person Proofing
When a foreign-passport holder cannot achieve a Standard myGovID through the app, Services Australia offers an in-person identity-proofing service at 318 service centres nationwide. The applicant must book an appointment through the Services Australia website and attend with their physical foreign passport, a printed or digital copy of their current visa grant notice, and a secondary identity document from the Services Australia Identity Documents List (category 2 or 3). Acceptable secondary documents include an Australian bank card displaying the applicant’s full name, a state-issued photo card, or an overseas driver licence accompanied by a NAATI-accredited English translation. Services Australia staff verify the passport visually, confirm the visa status in VEVO on-screen, and issue a linking code that the applicant enters into their myGov account within 24 hours. The linking code binds the myGov account to a verified identity record, enabling access to Centrelink, Medicare, and Child Support services without a myGovID credential. The ATO does not accept the Services Australia linking code for tax-related services; a separate ATO phone proofing process is required.
ATO Voice Biometrics and Phone Proofing
The ATO’s voice authentication system, deployed on its 13 28 61 general enquiries line, allows foreign-passport holders to verify their identity by speaking a passphrase after an initial manual proofing session. During the first call, the taxpayer provides their TFN, passport number, visa grant number, and Australian residential address. An ATO officer verifies the details against the Integrated Core Processing system and enrols the caller’s voiceprint. Subsequent calls authenticate the voiceprint without requiring a myGovID. The ATO’s 2023–24 Annual Report records 4.7 million enrolled voiceprints as at 30 June 2024. Voice authentication does not extend to online services; it provides telephone-only access to ATO account information and payment arrangements.
myGov Linking Code via Centrelink
For migrants whose immediate need is a Centrelink claim — such as Family Tax Benefit or the Low Income Health Care Card — a Centrelink officer can issue a myGov linking code after an in-person identity interview. The code is single-use and expires after 24 hours. Once linked, the myGov account displays Centrelink services without requiring a myGovID credential. This pathway does not provide access to Medicare enrolment; Medicare requires a separate Medicare card number and linking process through the Medicare online account or the Express Plus Medicare mobile app, both of which accept a myGov username-password login with two-factor authentication via SMS if a myGovID is unavailable.
Post-Setup Maintenance and Security Obligations
Updating Identity Documents After Visa Changes
When a foreign-passport holder is granted a new visa or renews their passport, the myGovID credential does not automatically update. The ATO’s Digital Identity Refresh Policy, effective 1 September 2024, requires the credential holder to delete the existing myGovID from the app and re-enrol using the new document. The re-enrolment triggers a fresh DVS and VEVO check. If the new visa is an excluded subclass, the re-enrolment will fail, and the user loses myGovID access. The ATO recommends completing re-enrolment within 14 days of receiving a new passport or visa grant notice to avoid service interruption.
Multi-Factor Authentication and Device Security
The myGovID app binds the credential to a single device using hardware-backed keystore encryption on Android and Secure Enclave on iOS. The ATO’s Security Requirements for myGovID, updated 10 January 2025, mandate a 6-digit PIN or biometric lock (fingerprint or face) to unlock the app. If the device is lost or reset, the credential must be recovered using the myGovID recovery process, which requires re-verification of the original identity documents. Foreign-passport holders who have renewed their passport since the original setup must complete the ImmiAccount passport update before initiating recovery; failure to do so results in a permanent lockout requiring ATO phone proofing.
Revocation and Fraud Prevention
The ATO’s fraud analytics engine, operating under the Identity Fraud Intelligence and Analytics Capability established in 2023, continuously monitors myGovID credential usage for anomalous patterns. A credential linked to a foreign passport that is subsequently reported lost or stolen to the issuing country’s authority is automatically suspended within 48 hours of the report propagating to the DVS. The suspension remains in effect until the credential holder presents a valid replacement passport through the re-enrolment process. The ATO’s 2023–24 fraud report, tabled in Parliament on 22 October 2024, recorded 1,837 myGovID suspensions related to foreign-passport discrepancies, representing 0.04% of the 4.6 million active myGovID credentials at that date.
Actionable Steps for New Arrivals
Verify the passport chip type before departure. Holders of non-ePassports should budget for an in-person Services Australia identity proofing appointment within the first week of arrival, as Centrelink waiting periods for some payments begin from the date of claim lodgment, not the date of identity verification. Update ImmiAccount with a new passport number immediately after passport renewal, and allow 72 hours for the VEVO record to synchronise before attempting myGovID setup or re-enrolment. Bookmark the ATO’s voice authentication enrolment line (13 28 61, option 3) as a fallback for tax-related queries if the myGovID app returns persistent DVS errors. For Medicare enrolment, attend a Services Australia service centre with a completed Medicare Enrolment Application form (MS004) and the foreign passport containing the current visa; the staff can issue a Medicare card number on the spot and activate a myGov link without requiring a myGovID credential. Finally, monitor the Department of Home Affairs DVS participant list every quarter — the Attorney-General’s Department adds 3–5 new nationalities per year, and a passport that fails verification today may become eligible within the same visa validity period.